AI-designed rewards help a fraud detector learn from blocked payments

Learning from decisions with missing outcomes

Fraud detectors learn from an incomplete record. Payments that go through can later acquire an unauthorized-chargeback label. Payments stopped by an earlier system never produce that outcome. Training only on approved transactions therefore leaves models learning from a selected slice of the traffic they must eventually judge.

Bo Qu, Zhurong Wang, Frank Zahradnik and Ming Ouyang, all affiliated with eBay, address this problem in an arXiv preprint submitted on November 5, 2026. The work extends their earlier approach published in the ACL 2025 Industry Track. The supplied record does not establish peer-reviewed publication of this new study.

Their proposal changes how a reinforcement-learning fraud detector is rewarded during training, rather than adding a language model to live payment decisions.

Two streams, one payment policy

The detector makes decisions at two checkpoints: before payment authorization and, for transactions it initially passes, after authorization. At each checkpoint it chooses whether to pass or block. A compact neural network learns this policy using REINFORCE, an algorithm that adjusts action probabilities according to rewards.

The new reward has two branches. For approved transactions with known outcomes, it rewards catching fraud and penalizes blocking legitimate payments or missing fraud, using dollar weights. For historically blocked transactions, whose outcomes remain unknown, it supplies a reward based on available risk evidence rather than a verified fraud label.

An approximately 27-billion-parameter, open-weight Qwen3-class language model writes candidate reward functions. Each valid candidate is used to train a fresh policy, whose evaluation results inform subsequent candidates. Both the new system and the labeled-only comparison received 40 rounds of 10 candidates, with 200 training episodes per candidate.

Training used February 2026 records: about 2.06 million labeled, approved transactions and 3.91 million previously blocked transactions. March data selected the best reward. April through July formed a separate historical test window, excluded from both policy training and reward selection. Chargeback labels were matured as of September 1.

What the generated code actually used

The proposed design emphasizes comparing current risk scores with older scores associated with the original blocking decisions. But the selected reward did not actually use those older scores to determine rewards. It normalized two legacy scores, then left those calculated values unused.

Instead, the blocked-transaction reward relied on one current risk-model score and buyer segment. It set segment-dependent thresholds and weights, rewarded actions according to their position relative to those thresholds, and favored blocking before authorization. Payment method and the other risk-model outputs did not affect the selected reward.

This distinction matters: the experiment supports the reported performance of the generated reward, not a demonstrated benefit from comparing old and new scores. The readable code makes that distinction inspectable. Although the paper describes leaving signal selection to the language model, its reproduced prompts also provide guidance about interpreting scores and buyer groups; the design process was not instruction-free discovery.

Higher pooled precision, uneven monthly results

The main measure was dollar-weighted precision at target dollar-weighted recall. Precision describes how much of the blocked transaction value is fraudulent; recall describes how much of the fraudulent value is caught.

Across the pooled four-month test, the dual-stream system achieved:

• At 80% target recall, 55.15% precision, versus 50.41% for the labeled-only agent and 47.09% for the production baseline.
• At 85%, 46.36%, versus 44.00% and 39.95%.
• At 90%, 35.92%, versus 32.95% and 29.91%.

These are gains of 4.74, 2.36 and 2.97 percentage points over the labeled-only agent. The average improvement over production was 6.83 points. Actual achieved recalls differed slightly because thresholds were selected from discrete operating points without interpolation.

Monthly results were less uniform. The dual-stream agent beat its labeled-only counterpart in all four months at 80% target recall, but lost in three months at 90%. At the pooled 90% target, however, it intercepted 64.8% of its blocked fraud value before authorization, compared with just 12.5% for the labeled-only agent—better meeting the study’s early-blocking objective.

What remains uncertain

The blocked payments still lack ground-truth outcomes. Their rewards assume current risk scores remain informative on that selected population; the authors warn that this can perpetuate existing bias. Generated rewards should not be mistaken for recovered fraud labels.

The study reports three training trials but provides no confidence intervals or detailed trial-by-trial results. Internal data from one payment system and a four-month historical test do not establish general performance or live deployment benefits.

The policy architecture remains unchanged, so the authors report no added inference cost; reward search still requires training computation. They also recommend human review, redress and monitoring for unequal impacts across buyer groups.